Dashboards & Visualizations

Hide data in frontend and remain set filters after reopening Splunk

julckr
Observer

Dear Splunk Community,

I am currently creating a Splunk dashboard and would like to save user-defined filters in the dashboard, even after Splunk has been reopened. 

Background: I have a table on a layer which data comes from SAP to Splunk via Push Extractor. Not all of the data displayed in the table is relevant, so I want to hide certain rows using a dropdown field/checkbox, which are then no longer included in the visualizations on the other layers.

  1. how can I ensure that these hidden rows are no longer included in the visualizations for all users of the dashboard?
  2. how can I ensure that the filter settings remain visible even after the dashboard has been closed for >24 hours?

I really hope that someone can help me with this.

Kind regards

Julian

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could output their choices to a csv store - these can be made user specific with the create_context argument

outputlookup - Splunk Documentation

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...